Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

evolution-foundation/evolution-api

              main @ fa09d37
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/api/controllers/instance.controller.ts: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The application used shell execution (execSync) to run system commands, allowing remote code execution if arguments were tainted. Parameterized execution via execFileSync must be consistently enforced.

Auth Bypass: Insufficient isolation in database query filters allowed users to list other clients' instances. Isolation based on API keys must be strictly enforced on all queries.

Path Traversal: The /assets route allowed arbitrary file reads due to missing path canonicalization. All static or dynamic file-serving endpoints must validate that resolved paths remain within allowed directories.